[Xitami] exploite ?

[Jacob Dahl Pind]

there seems to be a root exploite in xitami v2.4d9, seems as a user
can force access to the home dir of the user running the server. 
the upload dir was defined in the ftpdirs.aut as having PUT and 
make new directory rights, but somehow this person manage to
have read access from a subdir.

I have include a small part of the access log file
..
213.51.207.178 - anonymous [14/Nov/2001:12:43:44 +0100] "ftp://213.51.207.178//web/pub/upload/Tagged/By mysterio/Scannend by XioniXer/.tagged/hi mysterio greetz xionixer/~/###~~~***     Is Made By Mysterio      ***~~~###" 200 -1 "-" "l33ch@nowhere.org"
..
213.51.207.178 - anonymous [14/Nov/2001:12:51:57 +0100] "ftp://213.51.207.178//web/pub/upload/Tagged/By mysterio/Scannend by XioniXer/.tagged/hi mysterio greetz xionixer/ / .upload/###~~~***    This pub     ***~~~###" 200 -1 "-" "l33ch@nowhere.org"
..
213.51.207.178 - anonymous [14/Nov/2001:12:54:25 +0100] "ftp://213.51.207.178//web/pub/upload/Tagged/By mysterio/Scannend by XioniXer/.tagged/hi mysterio greetz xionixer/ / .upload/-=Gamez=-/Robin_Hoods_Tournament-EPH/eph-rht.001" 200 -1 "-" "l33ch@nowhere.org"

Right now I have disable the anonymous access to the ftp, but how can I makesure that
this won`t happen again ? 

Regards Jacob Dahl Pind
--
	CBM, Amiga,Vintage hardware collector
         Email: Rachael_@gmx.net 
	  url: http://rachael.dyndns.org